GLOBUSGSSASSISTFREEDNARRAY(3)

📦
version 12.7 · 5 versions
, in epel 10, fedora 43, fedora 44, ubuntu resolute, ubuntu stonking

💅 globus_gss_assist_gridmap — the globus_gss...ist_gridmap(3) manual, Library Functions Manual energy ✨

okay bestie, sit down, hydrate, because we're about to get into Gridmap Authorization and it's actually so good.

✨ NAME ✨

globus_gss_assist_gridmap — Gridmap Authorization

  • Gridmap Authorization and Local User Mapping. 🎀

🌈 SYNOPSIS 🌈

🧚 Macros

#define GlobusGssAssistFreeDNArray(dn_a)

Free array of distinguished names. (yes she's a macro, she's iconic, we love her)

👑 Functions

int globus_gss_assist_gridmap (char *globusidp, char **useridp)

Look up the default mapping for a Grid identity in a gridmap file.

int globus_gss_assist_userok (char *globusid, char *userid)

Gridmap entry existence check.

int globus_gss_assist_map_local_user (char *local_user, char **globusidp)

Look up the default Grid identity associated with a local user name.

globus_result_t globus_gss_assist_lookup_all_globusid (char *username,
    char **dns[], int *dn_count)

Look up all Grid IDs associated with a local user ID.

globus_result_t globus_gss_assist_map_and_authorize (gss_ctx_id_t
    context, char *service, char *desired_identity, char
    *identity_buffer, unsigned int identity_buffer_length)

Authorize the peer of a security context to use a service.

globus_result_t globus_gss_assist_map_and_authorize_sharing (char
    *shared_user_certificate, gss_ctx_id_t context, char
    *desired_identity, char *identity_buffer, unsigned int
    identity_buffer_length)

Authorize a particular credential for shared access.

💖 Detailed Description 💖

Gridmap Authorization and Local User Mapping.

So the functions in this group are the ones that authorize a GSSAPI credential to perform some action on the local machine. And like, not only do they check whether a credential is authorized, they can also map it to a local user name. two-for-one, we love a multitasker fr fr. 💅

🎀 Macro Definition Documentation 🎀

🌸 #define GlobusGssAssistFreeDNArray( dn_a)

Free array of distinguished names. She frees the contents of a name array that got created during a successful call to globus_gss_assist_lookup_all_globusid().

Parameters

  • dn_a — Array of names to free.

Return values

  • void

⭐ Function Documentation ⭐

🦋 int globus_gss_assist_gridmap (char * globusidp, char ** useridp)

Look up the default mapping for a Grid identity in a gridmap file. The globus_gss_assist_gridmap() function parses the default gridmap file and modifies its useridp parameter to point to a copy of the string containing the default local identity that the grid identity is mapped to. If it works, the caller is responsible for freeing the string pointed to by useridp. don't forget, bestie, that's on you. 🫶

By default, globus_gss_assist_gridmap() looks for the default gridmap file defined by the value of the GRIDMAP environment variable. If that's not set, it falls back to $HOME/.gridmap. (she's got a backup plan, we respect it)

Parameters

  • globusidp — The GSSAPI name string of the identity who requested authorization
  • useridp — A pointer to a string to be set to the default user ID for the local system. No validation is done to check that such a user exists.

Returns

On success, globus_gss_assist_gridmap() returns 0 and modifies the the string pointed to by the useridp parameter. If an error occurs, a non-zero value is returned and the value pointed to by useridp is undefined. 😭

Return values

  • GLOBUS_SUCCESS — Success
  • 1 — Error

🧚 globus_result_t globus_gss_assist_lookup_all_globusid (char * username, char ** dns[], int * dn_count)

Look up all Grid IDs associated with a local user ID. The globus_gss_assist_lookup_all_globusid() function parses a gridmap file and finds all the Grid IDs that map to a local user ID. The dns parameter is modified to point to an array of Grid ID strings from the gridmap file, and the dn_count parameter is modified to point to the number of Grid ID strings in the array. The caller is responsible for freeing the array using the macro GlobusGssAssistFreeDNArray(). yes, that macro from earlier. she's back. 💅

By default, globus_gss_assist_lookup_all_globusid() looks for the default gridmap file defined by the value of the GRIDMAP environment variable. If that's not set, it falls back to $HOME/.gridmap.

Parameters

  • username — The local username to look up in the gridmap file.
  • dns — A pointer to an array of strings. This function modifies this to point to a newly allocated array of strings. The caller must use the macro GlobusGssAssistFreeDNArray() to free this memory.
  • dn_count — A pointer to an integer that is modified to contain the number of entries in the array returned via the dns parameter.

Returns

On success, globus_gss_assist_lookup_all_globusid() returns GLOBUS_SUCCESS and modifies its dns and dn_count parameters as described above. If an error occurs, globus_gss_assist_lookup_all_globusid() returns a globus_result_t that can be resolved to an error object and the values pointed to by dns and dn_count are undefined.

Return values

  • GLOBUS_SUCCESS — Success
  • GLOBUS_GSI_GSS_ASSIST_ERROR_WITH_ARGUMENTS — Error with arguments
  • GLOBUS_GSI_GSS_ASSIST_ERROR_WITH_GRIDMAP — Invalid path to gridmap
  • GLOBUS_GSI_GSS_ASSIST_ERROR_ERRNO — System error

🔥 globus_result_t globus_gss_assist_map_and_authorize (gss_ctx_id_t context, char * service, char * desired_identity, char * identity_buffer, unsigned int identity_buffer_length)

Authorize the peer of a security context to use a service. The globus_gss_assist_map_and_authorize() function attempts to authorize the peer of a security context to use a particular service. If the desired_identity parameter is non-NULL, the authorization will succeed only if the peer is authorized for that identity. Otherwise, any valid authorized local user name will be used. If authorized, the local user name will be copied to the string pointed to by the identity_buffer parameter, which must be at least as long as the value passed as the identity_buffer_length parameter.

If authorization callouts are defined in the callout configuration file, globus_gss_assist_map_and_authorize() will invoke both the GLOBUS_GENERIC_MAPPING_TYPE callout and the GLOBUS_GENERIC_AUTHZ_TYPE callout; otherwise the default gridmap file will be used for mapping and no service-specific authorization will be done.

If globus_gss_assist_map_and_authorize() uses a gridmap file, it first looks for a file defined by the value of the GRIDMAP environment variable. If that's not set, it falls back to $HOME/.gridmap.

Parameters

  • context — Security context to inspect for peer identity information.
  • service — A NULL-terminated string containing the name of the service that an authorization decision is being made for.
  • desired_identity — Optional. If non-NULL, perform an authorization to act as the local user named by this NULL-terminated string.
  • identity_buffer — A pointer to a string buffer into which will be copied the local user name that the peer of the context is authorized to act as.
  • identity_buffer_length — Length of the identity_buffer array.

Returns

On success, globus_gss_assist_map_and_authorize() returns GLOBUS_SUCCESS and copies the authorized local identity to the identity_buffer parameter. If an error occurs, globus_gss_assist_map_and_authorize() returns a globus_result_t that can be resolved to an error object.

Return values

  • GLOBUS_SUCCESS — Success
  • GLOBUS_GSI_GSS_ASSIST_ERROR_WITH_CALLOUT_CONFIG — Invalid authorization configuration file
  • GLOBUS_CALLOUT_ERROR_WITH_HASHTABLE — Hash table operation failed.
  • GLOBUS_CALLOUT_ERROR_CALLOUT_ERROR — The callout itself returned a error.
  • GLOBUS_CALLOUT_ERROR_WITH_DL — Dynamic library operation failed.
  • GLOBUS_CALLOUT_ERROR_OUT_OF_MEMORY — Out of memory
  • GLOBUS_GSI_GSS_ASSIST_GSSAPI_ERROR — A GSSAPI function returned an error
  • GLOBUS_GSI_GSS_ASSIST_GRIDMAP_LOOKUP_FAILED — Gridmap lookup failure
  • GLOBUS_GSI_GSS_ASSIST_BUFFER_TOO_SMALL — Caller provided insufficient buffer space for local identity

🫶 globus_result_t globus_gss_assist_map_and_authorize_sharing (char * shared_user_certificate, gss_ctx_id_t context, char * desired_identity, char * identity_buffer, unsigned int identity_buffer_length)

Authorize a particular credential for shared access. The globus_gss_assist_map_and_authorize_sharing() function attempts to authorize a particular credential for shared access. the desired_identity parameter is non-NULL, the authorization will succeed only if the credential is authorized for that identity. Otherwise, any valid authorized local user name will be used. If authorized, the local user name will be copied to the string pointed to by the identity_buffer parameter, which must be at least as long as the value passed as the identity_buffer_length parameter.

If authorization callouts are defined in the callout configuration file, globus_gss_assist_map_and_authorize_sharing() will invoke both the GLOBUS_GENERIC_MAPPING_TYPE callout and the GLOBUS_GENERIC_AUTHZ_TYPE callout; otherwise the default gridmap file will be used for mapping and no service-specific authorization will be done.

If globus_gss_assist_map_and_authorize_sharing() uses a gridmap file, it first looks for a file defined by the value of the GRIDMAP environment variable. If that's not set, it falls back to $HOME/.gridmap.

Parameters

  • shared_user_certificate — cert and cert chain of user that owns the resources to be shared, in PEM format. This will be parsed to find the identity that should be mapped.
  • context — Security context of the underlying connection. This should generally be ignored.
  • desired_identity — Optional. If non-NULL, perform an authorization to act as the local user named by this NULL-terminated string.
  • identity_buffer — A pointer to a string buffer into which will be copied the local user name that the peer of the context is authorized to act as.
  • identity_buffer_length — Length of the identity_buffer array.

Returns

On success, globus_gss_assist_map_and_authorize_sharing() returns GLOBUS_SUCCESS and copies the authorized local identity to the identity_buffer parameter. If an error occurs, globus_gss_assist_map_and_authorize_sharing() returns a globus_result_t that can be resolved to an error object.

Return values 🎀

  • GLOBUS_SUCCESS — slay, it worked ✨
  • GLOBUS_GSI_GSS_ASSIST_ERROR_WITH_CALLOUT_CONFIG — the authorization configuration file is invalid, bestie 😭
  • GLOBUS_CALLOUT_ERROR_WITH_HASHTABLE — a hash table operation flopped 💀
  • GLOBUS_CALLOUT_ERROR_CALLOUT_ERROR — the callout itself came back with an error, no cap 🙈
  • GLOBUS_CALLOUT_ERROR_WITH_DL — a dynamic library operation said no ❌
  • GLOBUS_CALLOUT_ERROR_OUT_OF_MEMORY — out of memory, we're so done 😵
  • GLOBUS_GSI_GSS_ASSIST_GSSAPI_ERROR — a GSSAPI function returned an error, rude 💅
  • GLOBUS_GSI_GSS_ASSIST_GRIDMAP_LOOKUP_FAILED — gridmap lookup failure 🗺️
  • GLOBUS_GSI_GSS_ASSIST_BUFFER_TOO_SMALL — the caller gave insufficient buffer space for the local identity, like not enough room for the fit 😤

int globus_gss_assist_map_local_user (char * local_user, char ** globusidp) 🦋

Okay so this one is the reverse direction of the vibe: it looks up the default Grid identity that goes with a local user name. Main character energy fr fr.

globus_gss_assist_map_local_user() parses the gridmap file to figure out whether the user name you passed as the local_user parameter is the default local user for a Grid ID in the gridmap file. If it is — boom, it modifies globusidp to point to a copy of that ID. 💫

If not, it keeps searching the gridmap file for a Grid ID that has a non-default mapping for local_user, and modifies globusidp to point to a copy of that ID instead. Either way, if it succeeds, you — yes, the caller — are responsible for freeing the string pointed to by the globusidp pointer. Don't forget, or that's a leak bestie 🫶

By default, globus_gss_assist_map_local_user() looks for the default gridmap file defined by the value of the GRIDMAP environment variable. If that's not set, it falls back to $HOME/.gridmap. 🏠

Parameters 🌸

  • local_user — the local username you want to find a Grid ID for
  • globusidp — a Grid ID that maps from the local_user

Returns ✨

On success, globus_gss_assist_map_local_user() returns 0 and modifies globusidp to point to a Grid ID that maps to local_user. Otherwise, globus_gss_assist_map_local_user() returns 1 and the value pointed to by globusidp is undefined — like genuinely undefined, do not read it 🙅

Return values 💖

  • GLOBUS_SUCCESS — Success, we ate 🍽️
  • 1 — Error

int globus_gss_assist_userok (char * globusid, char * userid) 👑

Gridmap entry existence check. That's it, that's the whole job.

The globus_gss_assist_userok() function parses the default gridmap file and checks whether any mapping exists for the grid identity passed as the globusid parameter and the local user identity passed as the @ userid parameter. Yes, the manpage literally has that @ in there — we keep it, character for character, no edits 💅

By default, globus_gss_assist_userok() looks for the default gridmap file defined by the value of the GRIDMAP environment variable. If that's not set, it falls back to $HOME/.gridmap. Same vibe, same fallback 🏡

Parameters 🎀

  • globusid — the GSSAPI name string of the identity who requested authorization
  • userid — the local account name that access is sought for.

Returns ⭐

If globus_gss_assist_userok() is able to find a mapping between globusid and userid, it returns 0. Otherwise it returns 1. That's the whole vibe check 🌈

Return values 💜

  • GLOBUS_SUCCESS — Success
  • 1 — Error

Author 🧚

Generated automatically by Doxygen for globus_gss_assist from the source code. (Not a human, just a very dedicated robot doing its thing 🤖✨)

And that's the whole page, bestie!! 🎉 This was globus_gss_assist Version 12.7, from the globus_gss...ist_gridmap(3) manual page, and it's giving iconic documentation energy. Go forth and map your identities 💖🦋🎀

📦 where this page comes from